Frequently Asked Questions

What does ALCOA mean for GxP data integrity?

ALCOA is the FDA’s shorthand for trustworthy data. In its guidance on data integrity for drug CGMP, the FDA says complete, consistent, and accurate data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate. In practice, every record should show who did what and when, stay readable, and be kept in its original form or as a verified copy.

 

Can a software vendor make our system GxP compliant?

Not on its own. Under 21 CFR Part 11, the company that uses a system to create, maintain, or transmit electronic records is responsible for the procedures and controls around it. A vendor can supply the features you need, but your organization still has to validate the system for its intended use and maintain controls such as limited system access and change control over system documentation.

 

Does a GxP system stay validated after go-live?

Only if every change is controlled. Software updates and configuration changes can affect a validated system, so each one needs to be assessed, tested, and documented before release. Cloud platforms make this a recurring task. Veeva, for example, releases Vault CRM enhancements three times a year. Conexus validates software updates for GxP systems, including Veeva Vault, through a controlled process that covers planning, testing, and implementation.